Dismantling a 22m User Pirate IPTV Service Led to Big Rise in ISP Blocking

For those who enjoy reading professional reports filled with statistics and detailed analysis, the piracy landscape has an endless supply.

Many reports are highly informative and, regardless of underlying political aims, few get things completely wrong.

Yet, even the most detailed studies and elaborate industry reports can at times leave the reader feeling puzzled. On the one hand, multi-billion dollar companies have more piracy data and intelligence than anyone else, period. On the other, nobody needs a meteorologist’s report to determine whether it’s raining outside.

In no other area is this more evident than in the promotion of reportedly effective site-blocking measures; and in no other country has site-blocking been adopted so comprehensively than in Italy. Bur even with very few guardrails and direct access to every tool available, the last year has seen tens of thousands of IP addresses and domains blocked by rightsholders, despite an obvious decline in the availability of pirated content.

Targeting The Source

By definition, site-blocking doesn’t remove pirated content from the internet. That’s why removing suppliers from the ecosystem is seen as a much better response than putting up endless, easily circumvented roadblocks. Late November, an investigation led by the Italians came to fruition with an enforcement operation billed as the largest to ever target a pirate IPTV network.

Operation Takendown reportedly took place on November 26/27 and according to authorities in Italy and several other countries in Europe, it “dismantled” an international pirate IPTV network serving 22 million users and generating an estimated €3 billion per year. At least 11 suspects were detained and around 100 others were said to be under investigation. Meanwhile, there were reports of subscribers all over Europe losing access to channels and in some cases their entire service.

At the time, this certainly sounded like a very big deal. Law enforcement seized 29 servers, 270 pieces of IPTV equipment, searched 112 private homes, identified close to 600 IPTV subscription resellers, and seized EUR 1.6 million in cryptocurrency plus EUR 40,000 in cash. Since the pirate IPTV provider in question was seen as a significant threat to the Italian live sports and broadcasting sectors, its reported demise was enthusiastically celebrated in the media.

Eliminating such a massive supplier should in theory restrict availability of illegal streams in Italy, even if only temporarily. After all, that was the entire point of the operation. By extension then, demand for ISP blocking in Italy should be reduced too, even if only for a short time.

Three Weeks Before, Three Weeks After

While keeping an open mind, we expected a sizeable albeit temporary dip in blocking tickets filed at Piracy Shield, followed by a relatively short recovery as the pirate IPTV market repaired itself and everything returned to normal.

Using Piracy Shield blocking data unofficially made available at piracyshield.iperv.it, we took the raid dates of November 26/27 as the central point. From there we examined every blocking ticket filed by rightsholders in the three weeks preceding Operation Takendown, and for comparison every ticket filed in the three weeks after.

A typical Piracy Shield ticket (credit: piracyshield.iperv.it)

During that six-week period, rightsholders filed around 186 Piracy Shield tickets similar to the one above, containing instructions for local ISPs to block a total of 527 IP addresses and 3,322 fully qualified domain names.

The chart below shows domain name blocking in blue, IP address blocking in red, and the approximate dates of the operation in green in the center.

click to enlarge

The data reveals that in the three-week period leading up to the enforcement action, rightsholders’ tickets required ISPs to block 204 IP addresses after they were observed providing access to pirate IPTV.

In the three weeks following the claimed “dismantling” of the 22 million-user service, rightsholders’ tickets required ISPs to block 323 IP addresses, up 50%+ on the preceding three weeks.

In respect of domain name blocking, the 1,322 FQDNs requested in the three weeks before the takedown, were easily eclipsed by 2,000 domains listed for blocking in the three-week period afterward.

Apparently, there were still plenty of piracy threats. And indeed, reports from a number of sources indicate that subscribers who lost service around November 26/27 had their channels restored within 48/72 hours.

Meanwhile, tickets like the one below are being filed almost daily and on some days, several at a time. It’s a perpetual workload that somehow seems to increase when massive providers get shut down or ‘dismantled’.

From: TF, for the latest news on copyright battles, piracy and more.